Cybersecurity / DevSecOps / Senior Cyber Governance Consultant

ABGi Technology is recruiting on behalf of its client, a large industrial group in the energy sector, for its future Cybersecurity / DevSecOps / Senior Cyber Governance Consultant, based in Lyon.

Expected start date: 4 January 2027

🔎 YOUR MISSIONS

As part of a cross-functional programme to strengthen application cybersecurity, our client wants to support several business departments and development teams in improving their Cyber maturity and in integrating security best practices into their projects.

This programme concerns several dozen strategic business applications and aims in particular to strengthen the security of developments, structure vulnerability remediation efforts, integrate security controls into CI/CD pipelines and support teams in adopting DevSecOps and Shift-Left Security practices.

You will work at the intersection of application security (AppSec), DevSecOps, cross-functional management and support for project teams.

Your role will be to sustainably raise the security level of applications, coordinate remediation actions and lead a network of Cyber referents, while monitoring indicators and communicating with the various stakeholders.

The missions required of you:

Support for project teams and Cyber leadership

• Support development teams and application owners in integrating cybersecurity requirements.

• Organise and run workshops on awareness and training in application security best practices.

• Advise teams on identifying, understanding and reducing Cyber risks.

• Structure and lead a network of security referents and liaisons within the various business departments.

• Define and monitor the action plans associated with security liaisons.

• Organise regular follow-up meetings to measure progress on security actions.

• Facilitate communication between development teams, project managers, Cyber experts and the various directorates concerned.

• Support change management and encourage the adoption of security practices.

Application vulnerability analysis and application security

• Lead security reviews of business applications.

• Analyse vulnerabilities identified by application security tools.

• Exploit the results of SAST, DAST, SCA and MAST analyses.

• Identify obsolete software components, vulnerable dependencies and associated risks.

• Assess the criticality of vulnerabilities, relying in particular on the CVE, CWE and CVSS frameworks.

• Support teams in understanding the results of security analyses.

• Take part in defining corrective measures and technical recommendations.

• Contribute to the continuous improvement of application security levels.

Management of remediation plans

• Build and manage vulnerability remediation roadmaps.

• Prioritise corrective actions according to their criticality, business impact and project constraints.

• Coordinate the technical teams involved in correcting vulnerabilities.

• Monitor actions and remediation deadlines.

• Identify blockers and propose suitable solutions.

• Measure the effectiveness of the corrections made.

• Consolidate results and report on changes in risk exposure.

Integrating security into DevSecOps practices

• Support teams in integrating security controls into CI/CD pipelines.

• Take part in improving secure development processes.

• Facilitate the use and adoption of GitLab, GitLab Ultimate, Checkmarx and SonarQube tools.

• Support the implementation and operation of SAST, DAST, SCA and Security Gates controls.

• Raise developers' awareness of Secure Development Lifecycle (SDLC) best practices.

• Promote Shift-Left Security approaches, aiming to integrate security from the earliest phases of development.

• Contribute to automating controls and making development pipelines more reliable.

• Identify opportunities to improve existing DevSecOps practices.

Assessment of Cyber maturity

• Take part in defining a Cyber maturity assessment grid applicable to the various projects.

• Periodically assess the security level of applications and teams.

• Identify gaps against security requirements and frameworks.

• Define areas for progress and improvement actions.

• Build and maintain Cyber maturity indicators.

• Measure progress made over successive assessment campaigns.

• Contribute to harmonising cybersecurity practices across the various departments.

Cross-functional management, governance and reporting

• Coordinate interactions between application teams, Cyber experts, business managers and project teams.

• Produce and consolidate cybersecurity KPIs.

• Build and maintain monitoring dashboards, notably using Power BI.

• Monitor progress on action plans and security trajectories.

• Prepare and contribute to Cyber steering committees.

• Present results, risks, alerts and recommendations to the various stakeholders.

• Escalate difficulties and points requiring arbitration.

• Contribute to application cybersecurity governance and to meeting commitments on outcomes.

Documentation and knowledge capitalisation

• Produce and maintain practical application cybersecurity guides.

• Write procedures and recommendations intended for technical teams.

• Design training and awareness materials.

• Formalise frameworks, quick-reference sheets and DevSecOps best practices.

• Structure and populate collaborative documentation spaces.

• Capitalise on lessons learned to improve securing processes.

• Take part in standardising monitoring and remediation methods.

🎯 OUR REQUIREMENTS

Required skills and experience:

• Significant professional experience in application cybersecurity, DevSecOps or development security, with the ability to operate at a senior level.

• Good command of application security issues and software development lifecycles.

• Practical experience in analysing and managing application vulnerabilities.

• Good knowledge of SAST, DAST, SCA and automated security controls approaches.

• Experience integrating security into CI/CD pipelines.

• Ability to understand and exploit results from security tools such as Checkmarx, SonarQube or equivalent solutions.

• Good understanding of DevSecOps, Secure Development Lifecycle and Shift-Left Security practices.

• Experience defining and managing remediation plans.

• Ability to analyse and prioritise vulnerabilities according to their criticality and impact.

• Experience in cross-functional management of cybersecurity initiatives involving several teams.

• Ability to build indicators, produce dashboards and provide Cyber reporting.

• Experience supporting, raising awareness among or training technical teams.

• Ability to run workshops and rally stakeholders around security objectives.

• Good command of technical documentation and collaborative tools.

• Ability to explain cybersecurity topics to both technical and non-technical stakeholders.

The following skills are considered real assets:

• In-depth experience with GitLab and GitLab Ultimate.

• Proficiency in Checkmarx, SonarQube or other application security analysis tools.

• Experience defining and implementing Security Gates.

• Knowledge of ISO 27001 and ISO 27002 frameworks.

• Good command of the OWASP Top 10 and the main families of application vulnerabilities.

• Knowledge of the NIS2 directive and the CIS Controls.

• Command of the CWE, CVE and CVSS frameworks.

• Experience assessing the Cyber maturity of application projects.

• Experience leading communities of security referents.

• Ability to structure a Cyber governance approach across several applications or departments.

• Knowledge of Jira, Confluence, SharePoint, Teams and Microsoft 365 tools.

• Experience building dashboards and reporting with Power BI.

• Experience in change management and continuous improvement of security practices.

• Experience in an industrial environment or within an organisation with a large application portfolio.

Experience in the energy, industry, critical infrastructure sectors or within a large group with numerous business applications is an advantage.

👤 PROFILE SOUGHT

Holding a Bac+3 to Bac+5 qualification (degree level 3 to 5) in computing, cybersecurity, information systems or an equivalent field, you can demonstrate significant professional experience in application cybersecurity and DevSecOps, ideally gained in complex technical environments.

You have a genuine dual competence: technical expertise in application security and an ability to manage cross-functional Cyber initiatives across multiple teams.

You know how to analyse the results of vulnerability detection tools, support developers in their remediation and contribute to integrating security into development processes.

Beyond your technical skills, you are able to structure action plans, lead communities of security referents, produce relevant indicators and communicate effectively with different levels of stakeholders.

You are autonomous, rigorous, organised and results-oriented. Your analytical mind, your teaching ability and your capacity to bring teams together are essential qualities for success in this role.

You enjoy environments where cybersecurity must be integrated concretely into team practices, balancing security requirements, operational constraints and change support.

This position is intended for a versatile profile combining AppSec / DevSecOps expertise, Cyber management and team support, rather than a specialist exclusively in SOC, CISO or PMO roles.

#LI-ABGI